@artifact-keeper/sdk 1.6.0 → 1.7.3

package/src/types.gen.ts

@@ -126,6 +126,10 @@ export type AffectedRepo = {
 export type AgeGateConfigResponse = {
     enabled: boolean;
     min_age_days: number;
+    /**
+     * Age-source mode: `upstream_publish_time` or `first_seen` (#2264).
+     */
+    mode: string;
     repository_key: string;
 };
 
@@ -303,7 +307,19 @@ export type ArtifactListResponse = {
      * Docker tag grouping.  Only present when `group_by=docker_tag`.
      */
     docker_tags?: Array<DockerTagResponse> | null;
+    /**
+     * Whether another page exists after this one (#2520, #2518). Present on
+     * keyset-paged listings (flat and grouped); authoritative regardless of
+     * the `pagination.total` mode (exact vs lower bound).
+     */
+    has_more?: boolean | null;
     items: Array<ArtifactResponse>;
+    /**
+     * Opaque keyset cursor for the next page (#2520, #2518). Present on
+     * keyset-paged listings (flat and grouped) when another page exists;
+     * pass it back via `?cursor=`.
+     */
+    next_cursor?: string | null;
     pagination: Pagination;
 };
 
@@ -353,6 +369,31 @@ export type ArtifactResponse = {
     } | null;
     name: string;
     path: string;
+    /**
+     * Per-artifact quarantine state so a client/operator can tell which
+     * listed artifacts are held for security review (#2940). Always
+     * serialized so the listing never hides the control:
+     * - `"quarantined"` — held pending review; downloads return 409 (until
+     * any `quarantine_until` lapses),
+     * - `"rejected"` — terminally blocked by an admin,
+     * - a scan-lifecycle state (`"clean"`, `"flagged"`, `"unscanned"`,
+     * `"released"`),
+     * - `"not_quarantined"` — the explicit default when the row carries no
+     * quarantine state, so clients never have to treat a missing value as
+     * a state.
+     *
+     * The human-readable *reason* is intentionally NOT surfaced here: it is
+     * per-artifact security detail disclosed only by the authenticated,
+     * repository-visibility-checked `GET /api/v1/quarantine/{id}` (#2912),
+     * whereas this listing is reachable anonymously on public repositories.
+     */
+    quarantine_status: string;
+    /**
+     * When a timed quarantine hold lapses and the artifact becomes
+     * downloadable again. `None` for a permanent (admin) quarantine and for
+     * artifacts that are not quarantined. (#2940)
+     */
+    quarantine_until?: string | null;
     repository_key: string;
     /**
      * Server-assigned revision number for repositories with first-class
@@ -496,6 +537,18 @@ export type AuthConfig = {
      * Whether an LDAP directory is configured.
      */
     ldap_enabled: boolean;
+    /**
+     * Whether the login UI should offer the local username/password form
+     * (issue #2621). `true` when no SSO provider is enabled; with SSO
+     * enabled it is `true` only when the operator explicitly opted in via
+     * `ALLOW_LOCAL_ADMIN_LOGIN=true` and has not enforced strict SSO-only
+     * via `SSO_DISABLE_ADMIN_BREAK_GLASS`. Display-only: the login endpoint
+     * independently enforces the same policy server-side
+     * (`api::handlers::auth::local_login_gate`), so this flag never grants
+     * access by itself. LDAP is separate — the UI shows the credentials form
+     * for enabled LDAP providers regardless of this flag.
+     */
+    local_login_enabled: boolean;
     /**
      * Whether an OIDC provider is configured.
      */
@@ -1023,7 +1076,40 @@ export type CreateApiTokenResponse = {
 };
 
 export type CreateBackupRequest = {
+    /**
+     * Repository ids to exclude from a full or incremental backup (#2772).
+     *
+     * Airgapped or bandwidth-limited deployments use this to keep specific
+     * repositories out of the backup. When omitted or empty nothing is
+     * excluded, so existing behavior is unchanged. If `repository_ids` is
+     * also supplied the excluded ids are removed from that include list;
+     * otherwise every repository except the excluded ones is backed up.
+     */
+    exclude_repositories?: Array<string> | null;
+    /**
+     * Optional custom name/label for the backup archive (#2790).
+     *
+     * When provided it becomes the identifying part of the archive
+     * filename. Restricted to letters, digits, `.`, `_`, and `-`; when
+     * omitted the archive keeps its default `{uuid}` name.
+     */
+    name?: string | null;
+    /**
+     * Explicit allow-list of repository ids to include in the backup.
+     *
+     * When omitted every repository is backed up (subject to
+     * `exclude_repositories`).
+     */
     repository_ids?: Array<string> | null;
+    /**
+     * Optional RFC3339 lower bound on artifact modification time (#2789).
+     *
+     * When set, the (typically incremental) backup includes only artifacts
+     * whose `updated_at` is at or after this timestamp, capturing just the
+     * changes made from the given date/time to now. When omitted every
+     * artifact is included, so backup behavior is unchanged.
+     */
+    since?: string | null;
     type?: string | null;
 };
 
@@ -1122,11 +1208,24 @@ export type CreateLdapConfigRequest = {
     admin_group_dn?: string | null;
     bind_dn?: string | null;
     bind_password?: string | null;
+    /**
+     * Inline PEM CA certificate/chain to trust for this provider's LDAPS/
+     * STARTTLS handshake (migration 174, #2782). Send an empty string to
+     * clear a previously stored certificate.
+     */
+    ca_certificate?: string | null;
     display_name_attribute?: string | null;
     email_attribute?: string | null;
     group_base_dn?: string | null;
     group_filter?: string | null;
     groups_attribute?: string | null;
+    /**
+     * Opt-in (migration 174, #2782): skip TLS certificate verification for
+     * this provider's LDAPS/STARTTLS handshake. Defaults false
+     * (secure-by-default). Only enable for trusted networks / private CAs
+     * you cannot import.
+     */
+    insecure_skip_verify?: boolean | null;
     is_enabled?: boolean | null;
     name: string;
     priority?: number | null;
@@ -1285,6 +1384,14 @@ export type CreateRepositoryRequest = {
      * Stored in `repository_config` under `apt_release_version`.
      */
     apt_release_version?: string | null;
+    /**
+     * Opt into ingesting UNVERIFIED upstream metadata on the keyless RPM
+     * curation-sync path (#2569). Omit or `false` to keep the fail-closed
+     * default (a keyless curation sync refuses to ingest unverified upstream
+     * packages); `true` reverts to the legacy unverified-ingest behavior. Only
+     * meaningful for RPM curation staging repositories.
+     */
+    curation_allow_unverified?: boolean | null;
     /**
      * Custom User-Agent sent on outbound HTTP requests to the upstream for
      * this repository. Only valid for remote repositories. Max 256 characters.
@@ -1626,28 +1733,42 @@ export type CreateWebhookRequest = {
 export type CreatedGroupRow = {
     created_at: string;
     description?: string | null;
+    external_source?: string | null;
     id: string;
     name: string;
     updated_at: string;
 };
 
-export type CreatedPermissionRow = {
-    actions: Array<string>;
-    created_at: string;
-    id: string;
-    principal_id: string;
-    principal_type: string;
-    target_id: string;
-    target_type: string;
-    updated_at: string;
-};
-
 export type CurationCreateRuleRequest = {
     action: string;
     architecture?: string;
-    package_pattern: string;
+    /**
+     * Engine-specific parameters (JSON object). `{}` for `pattern` rules.
+     */
+    config?: {
+        [key: string]: unknown;
+    };
+    /**
+     * Only meaningful for `rule_type = "pattern"`; defaults to `*` so typed
+     * rules (`publisher_trust`, `popularity`) can omit it.
+     */
+    package_pattern?: string;
     priority?: number;
     reason: string;
+    /**
+     * Evaluation engine: `pattern` (default), `publisher_trust`, `popularity`.
+     */
+    rule_type?: string;
+    /**
+     * `repository` (default when `staging_repo_id` is set) or `global`.
+     * When present it must be consistent with `staging_repo_id`: `global`
+     * forbids a repo id, `repository` requires one.
+     */
+    scope?: string | null;
+    /**
+     * Omit (with `scope: "global"` or no `scope`) to create an instance-wide
+     * baseline rule; set to attach the rule to one staging repository.
+     */
     staging_repo_id?: string | null;
     version_constraint?: string;
 };
@@ -1677,10 +1798,20 @@ export type CurationPackageResponse = {
 export type CurationUpdateRuleRequest = {
     action: string;
     architecture?: string;
+    /**
+     * Engine-specific parameters (JSON object). `{}` for `pattern` rules.
+     */
+    config?: {
+        [key: string]: unknown;
+    };
     enabled?: boolean;
     package_pattern: string;
     priority?: number;
     reason: string;
+    /**
+     * Evaluation engine: `pattern` (default), `publisher_trust`, `popularity`.
+     */
+    rule_type?: string;
     version_constraint?: string;
 };
 
@@ -1807,6 +1938,7 @@ export type DbPoolStats = {
  * the default when none exists yet.
  */
 export type DebianConfigPatch = {
+    allow_encoded_separators?: boolean | null;
     architectures?: Array<string> | null;
     components?: Array<string> | null;
     distribution_paths?: Array<string> | null;
@@ -1846,6 +1978,15 @@ export type DebianPackageFetchStrategy = 'upstream_passthrough' | 'eager';
  * permitted regardless of the `architectures` allowlist.
  */
 export type DebianRepositoryConfig = {
+    /**
+     * Defense-in-depth (#2562): when `false` (the default) a proxy request
+     * whose path carries a percent-encoded path separator (`%2f` = `/`,
+     * `%5c` = `\`, at any decode layer) is rejected with 400 before any
+     * upstream fetch. APT never percent-encodes path separators, so this only
+     * ever blocks path-confusion/traversal probes; set it `true` to opt out
+     * for a nonstandard upstream that genuinely requires encoded separators.
+     */
+    allow_encoded_separators?: boolean;
     /**
      * Architectures (e.g. `amd64`, `arm64`) to proxy. Empty/`["*"]` = all.
      * `all` (arch-independent) is always permitted.
@@ -2029,6 +2170,13 @@ export type DownloadRecord = {
 export type DownloadTrend = {
     date: string;
     download_count: number;
+    /**
+     * Proxy-served (pull-through) downloads for the day, from the sibling
+     * `proxy_download_statistics` table (#2537/#2704). Additive: hosted
+     * serves stay in `download_count` unchanged; defaults to 0 when
+     * deserializing older payloads.
+     */
+    proxy_download_count?: number;
 };
 
 /**
@@ -2476,6 +2624,10 @@ export type GroupMemberResponse = {
 export type GroupResponse = {
     created_at: string;
     description?: string | null;
+    /**
+     * See [`GroupRow::external_source`]; lets the frontend disable member editing for SSO groups.
+     */
+    external_source?: string | null;
     id: string;
     member_count: number;
     name: string;
@@ -2485,6 +2637,10 @@ export type GroupResponse = {
 export type GroupRow = {
     created_at: string;
     description?: string | null;
+    /**
+     * SSO provider owning the group (`oidc`/`saml`/`ldap`); `None` for local groups. IdP owns membership (#2874).
+     */
+    external_source?: string | null;
     id: string;
     member_count: number;
     name: string;
@@ -2493,6 +2649,18 @@ export type GroupRow = {
 
 /**
  * Growth summary for a time range.
+ *
+ * Computed from `storage_metrics` daily snapshots. **Accounting-basis note
+ * (#3249):** snapshots taken before the #3134/#3249 fix summed
+ * `artifacts.size_bytes` only, missing OCI layer/config blob bytes
+ * (`oci_blobs`) and proxy-cached bytes (`proxy_cache_artifacts`) while
+ * counting legacy backfilled `proxy-cache/%` rows. Those historical rows are
+ * deliberately left as recorded — the source tables hold no history, so past
+ * values cannot be recomputed, only fabricated. A growth series that spans
+ * the fix date therefore shows a one-day upward step in
+ * `storage_bytes_start/end` / `storage_growth_bytes` /
+ * `storage_growth_percent` when the corrected accounting first lands; it is
+ * a measurement correction, not real growth.
  */
 export type GrowthSummary = {
     artifacts_added: number;
@@ -2643,7 +2811,20 @@ export type LdapConfigResponse = {
     group_filter?: string | null;
     groups_attribute: string;
     has_bind_password: boolean;
+    /**
+     * Whether a custom inline CA certificate is configured for this provider
+     * (migration 174, #2782). The PEM itself is not returned.
+     */
+    has_ca_certificate: boolean;
     id: string;
+    /**
+     * Opt-in flag (migration 174, #2782): when true, TLS certificate
+     * verification is skipped for this provider's LDAPS/STARTTLS handshake.
+     * Defaults false (secure-by-default). Matches Harbor's "insecure skip
+     * verify"; only enable for trusted networks / private CAs you cannot
+     * import.
+     */
+    insecure_skip_verify: boolean;
     is_enabled: boolean;
     name: string;
     priority: number;
@@ -2711,6 +2892,23 @@ export type LifecyclePolicy = {
 };
 
 export type ListArtifactsQuery = {
+    /**
+     * Total-count mode for keyset-paged listings (#2520, #2519).
+     * `count=exact` runs a dedicated COUNT query so `pagination.total` is
+     * exact; otherwise the keyset-paged listings report a cheap lower bound
+     * (rows seen so far, +1 when another page exists) and `has_more` is the
+     * authoritative "is there a next page" signal.
+     */
+    count?: string | null;
+    /**
+     * Opaque keyset cursor (#2520, #2519, #2518). Pass the `next_cursor`
+     * value from the previous response to fetch the next page; `page` is
+     * ignored while a cursor is present. Supported by the flat artifact
+     * listing of hosted/local, virtual, and remote repositories (#2518,
+     * #2519), by `group_by=docker_tag`, and by `group_by=maven_component`
+     * on remote repositories; other listing modes ignore it.
+     */
+    cursor?: string | null;
     /**
      * Server-side artifact grouping.
      *
@@ -3715,9 +3913,23 @@ export type QuarantineActionResponse = {
     new_status: string;
 };
 
+export type QuarantineNowRequest = {
+    /**
+     * Reason shown to developers whose downloads are blocked.
+     */
+    reason?: string | null;
+};
+
 export type QuarantineStatusResponse = {
     artifact_id: string;
     is_blocked: boolean;
+    /**
+     * Why the artifact is held, when one was recorded by a scan policy or an
+     * admin. This is the only surface that discloses the reason: blocked
+     * downloads return a generic message because they are reachable
+     * anonymously on public repositories (#2912).
+     */
+    quarantine_reason?: string | null;
     quarantine_status?: string | null;
     quarantine_until?: string | null;
 };
@@ -3920,6 +4132,19 @@ export type RepositoryResponse = {
      */
     apt_release_version?: string | null;
     created_at: string;
+    /**
+     * Stance applied when no curation rule matches: `allow` or `review`.
+     */
+    curation_default_action: string;
+    /**
+     * Whether curation rules are enforced for this repository (#2912).
+     *
+     * Echoed back because this flag now *blocks downloads* on the PyPI proxy
+     * paths, and a security control that cannot be read back is the same class of
+     * problem as one that is stored but not enforced. Stored on the repositories
+     * row, so unlike `quarantine_enabled` this needs no separate lookup.
+     */
+    curation_enabled: boolean;
     /**
      * Custom User-Agent used for outbound HTTP requests to the upstream,
      * read back from `repository_config`. `None` when unset.
@@ -4024,6 +4249,15 @@ export type RepositoryStorageBreakdown = {
     download_count: number;
     format: string;
     last_upload_at?: string | null;
+    /**
+     * Downloads served by this repository's remote pull-through proxy
+     * (`proxy_download_statistics`, #2537/#2704). Proxy-cached objects carry
+     * no `artifacts` row (#1280), so these serves are counted in a sibling
+     * table and were previously not readable through any API. Kept separate
+     * from `download_count` (hosted serves) so existing consumers are
+     * unaffected; defaults to 0 when deserializing older payloads.
+     */
+    proxy_download_count?: number;
     repository_id: string;
     repository_key: string;
     repository_name: string;
@@ -4107,6 +4341,52 @@ export type RepositoryStorageStatsResponse = {
     unique_bytes?: number | null;
 };
 
+/**
+ * Per-prefix (folder tree) storage rollup response (#2601).
+ *
+ * All figures are read from the materialized `repository_path_storage_stats`
+ * cache (refreshed on the storage-stats schedule + post-GC) — a tree call is
+ * an index scan over pre-aggregated rows, never a walk of the artifact table.
+ *
+ * Every figure is within-repository only (references this repo holds), so
+ * unlike the repo-level endpoint's cross-tenant-derivable dedup breakdown
+ * (#2560) nothing here needs an admin restriction beyond repo visibility.
+ */
+export type RepositoryStorageTreeResponse = {
+    /**
+     * Descendant folder nodes, up to `depth` levels below `node`, largest
+     * `logical_bytes` first.
+     */
+    children: Array<StorageTreeNode>;
+    /**
+     * When the rollup was last recomputed. `null` before the first refresh.
+     */
+    computed_at?: string | null;
+    /**
+     * Folder levels below the root that are individually materialized;
+     * deeper files roll up into their ancestor at this depth.
+     */
+    max_materialized_depth: number;
+    /**
+     * The node the listing is rooted at (zeros when the prefix has no
+     * materialized data — unknown folder or refresher not yet run).
+     */
+    node: StorageTreeNode;
+    repository_key: string;
+    /**
+     * True when `limit` cut the descendant listing.
+     */
+    truncated: boolean;
+    /**
+     * Bytes referenced by this repository that carry no logical path and so
+     * cannot be placed in the tree (today: OCI layer blobs; the blob→image
+     * edge lives only in manifest content). Root-level figure; present only
+     * when the request is rooted at `''`. `node.logical_bytes +
+     * unattributed_bytes` reconciles with the repo-level logical total.
+     */
+    unattributed_bytes?: number | null;
+};
+
 export type RescanForInventoryRequest = {
     /**
      * Maximum number of artifacts to enqueue in this call. Operators
@@ -4187,6 +4467,12 @@ export type RoleResponse = {
 
 /**
  * Response returned by the rotate-secret endpoint.
+ *
+ * GHSA-qcmj: the raw signing secret is intentionally NOT returned here. A
+ * rotation only reports success and non-reversible metadata (the display
+ * `secret_digest` and the previous-secret expiry); the new raw secret is
+ * retained only in encrypted form and delivered/consumed out-of-band, so it
+ * cannot be disclosed via this response body or logs.
  */
 export type RotateWebhookSecretResponse = {
     id: string;
@@ -4195,9 +4481,8 @@ export type RotateWebhookSecretResponse = {
      */
     previous_secret_expires_at: string;
     /**
-     * Raw signing secret produced by this rotation. Shown exactly once.
+     * Short, non-reversible identifier for the newly active signing secret.
      */
-    secret: string;
     secret_digest: string;
 };
 
@@ -4232,6 +4517,9 @@ export type RuleEvaluationResponse = {
 export type RuleResponse = {
     action: string;
     architecture: string;
+    config: {
+        [key: string]: unknown;
+    };
     created_at: string;
     created_by?: string | null;
     enabled: boolean;
@@ -4239,6 +4527,8 @@ export type RuleResponse = {
     package_pattern: string;
     priority: number;
     reason: string;
+    rule_type: string;
+    scope: string;
     staging_repo_id?: string | null;
     updated_at: string;
     version_constraint: string;
@@ -4314,13 +4604,26 @@ export type SbomResponse = {
 };
 
 export type ScanConfigResponse = {
+    /**
+     * Persisted and returned, but not currently consulted by any enforcement
+     * gate — blocking is configured via scan policies instead (#3144/#3246).
+     */
     block_on_policy_violation: boolean;
     created_at: string;
     id: string;
+    /**
+     * #2954: fail-open (default) / fail-closed action for the inline proxy
+     * scan-on-fetch.
+     */
+    proxy_scan_action: string;
     repository_id: string;
     scan_enabled: boolean;
     scan_on_proxy: boolean;
     scan_on_upload: boolean;
+    /**
+     * Persisted and returned, but not currently consulted by any enforcement
+     * gate (#3243).
+     */
     severity_threshold: string;
     updated_at: string;
 };
@@ -4553,6 +4856,13 @@ export type SetRoutingRulesRequest = {
  * Response body for the setup status endpoint.
  */
 export type SetupStatusResponse = {
+    /**
+     * Optional deployment-aware instruction for retrieving the generated
+     * initial admin password, sourced from the `SETUP_PASSWORD_HINT` env var.
+     * Present only when an operator has configured it; when absent, the web UI
+     * falls back to its built-in Docker Compose instruction (#2802).
+     */
+    setup_password_hint?: string | null;
     /**
      * Whether the initial admin password change is still required.
      */
@@ -4718,13 +5028,87 @@ export type StorageGcResult = {
  */
 export type StorageSnapshot = {
     snapshot_date: string;
+    /**
+     * Rows in `artifacts` (for OCI repositories that is manifests only —
+     * layer/config blobs are content-addressed objects, not artifacts), the
+     * same deliberate decision as the dashboard's
+     * `SystemStats::total_artifacts` (#3134). Unlike the byte total, this
+     * count still includes legacy backfilled `proxy-cache/%` rows.
+     */
     total_artifacts: number;
     total_downloads: number;
     total_repositories: number;
+    /**
+     * All stored bytes at snapshot time, summed from
+     * `repository_usage_ledger` (`hosted_bytes + proxy_bytes + oci_bytes`) —
+     * the same source as the dashboard `total_storage_bytes` and quota
+     * admission (#3134/#3249), so the analytics series is consistent with
+     * both by construction. Includes OCI layer/config blob bytes
+     * (`oci_blobs`) and proxy-cached bytes (`proxy_cache_artifacts`);
+     * excludes legacy backfilled `proxy-cache/%` `artifacts` rows (their
+     * bytes are represented by the proxy-cache catalog instead). This is the
+     * LOGICAL figure: a blob cross-repo-mounted into N repositories counts
+     * once per repository, matching the per-repo storage column and quota.
+     */
     total_storage_bytes: number;
     total_users: number;
 };
 
+/**
+ * One folder node in the per-prefix storage rollup (#2601).
+ */
+export type StorageTreeNode = {
+    /**
+     * Distinct physical objects under this prefix.
+     */
+    blob_count: number;
+    /**
+     * Number of path segments in `prefix` (0 = root).
+     */
+    depth: number;
+    /**
+     * References (artifact/proxy-cache rows) under this prefix.
+     */
+    file_count: number;
+    /**
+     * Sum over every artifact/proxy-cache reference under this prefix.
+     */
+    logical_bytes: number;
+    /**
+     * Deduplicated within this repository: each distinct physical object
+     * under the prefix counted once. Because an object shared by two sibling
+     * subtrees counts once in each but once at their common ancestor, the sum
+     * of children's `physical_bytes` can exceed the parent's — the difference
+     * is the cross-subtree dedup saving.
+     */
+    physical_bytes: number;
+    /**
+     * Canonical prefix (no leading/trailing `/`; `''` = repository root).
+     */
+    prefix: string;
+};
+
+/**
+ * Query parameters for the per-prefix storage tree (#2601).
+ */
+export type StorageTreeQuery = {
+    /**
+     * How many tree levels below `prefix` to return (default 1 = immediate
+     * children, clamped to 1..=5).
+     */
+    depth?: number | null;
+    /**
+     * Maximum number of descendant nodes returned (default 200, clamped to
+     * 1..=1000). `truncated` is set when the limit cut the listing.
+     */
+    limit?: number | null;
+    /**
+     * Folder prefix to root the listing at (`''`/absent = repository root).
+     * Leading/trailing slashes are ignored.
+     */
+    prefix?: string | null;
+};
+
 export type SubmitCrashesRequest = {
     ids: Array<string>;
 };
@@ -4916,9 +5300,31 @@ export type SystemSettings = {
 export type SystemStats = {
     active_peers: number;
     pending_sync_tasks: number;
+    /**
+     * Proxy-cached (pull-through) objects, tracked in `proxy_cache_artifacts`
+     * rather than `artifacts`. Since #3134 the byte figure is a breakdown of
+     * `total_storage_bytes` (do not add the two).
+     */
+    proxy_artifact_count: number;
+    proxy_storage_bytes: number;
+    /**
+     * Rows in `artifacts` (for OCI repositories that is manifests only —
+     * layer/config blobs are content-addressed objects, not artifacts).
+     * Unlike the byte total, this count still includes legacy backfilled
+     * `proxy-cache/%` rows.
+     */
     total_artifacts: number;
     total_downloads: number;
     total_repositories: number;
+    /**
+     * All stored bytes, summed from `repository_usage_ledger`
+     * (`hosted_bytes + proxy_bytes + oci_bytes`) — the same source the
+     * per-repository `storage_used_bytes` figures are read from, so the
+     * dashboard total is consistent with the per-repo column by
+     * construction (#3134). Includes OCI layer/config blob bytes
+     * (`oci_blobs`) and proxy-cached bytes; `proxy_storage_bytes` below is
+     * a *breakdown* of this total, not a disjoint bucket.
+     */
     total_storage_bytes: number;
     total_users: number;
 };
@@ -5140,6 +5546,11 @@ export type UninstallQuery = {
 export type UpdateAgeGateConfigRequest = {
     enabled: boolean;
     min_age_days: number;
+    /**
+     * Age-source mode. Omitted = keep the repository's current mode, so
+     * pre-mode clients that PUT `{enabled, min_age_days}` stay valid.
+     */
+    mode?: string | null;
 };
 
 export type UpdateAnalysisBody = {
@@ -5204,11 +5615,21 @@ export type UpdateLdapConfigRequest = {
     admin_group_dn?: string | null;
     bind_dn?: string | null;
     bind_password?: string | null;
+    /**
+     * Inline PEM CA certificate/chain (migration 174, #2782). Omit to leave
+     * unchanged; send an empty string to clear.
+     */
+    ca_certificate?: string | null;
     display_name_attribute?: string | null;
     email_attribute?: string | null;
     group_base_dn?: string | null;
     group_filter?: string | null;
     groups_attribute?: string | null;
+    /**
+     * See `CreateLdapConfigRequest::insecure_skip_verify` (migration 174,
+     * #2782). Omit to leave the stored value unchanged.
+     */
+    insecure_skip_verify?: boolean | null;
     is_enabled?: boolean | null;
     name?: string | null;
     priority?: number | null;
@@ -5336,6 +5757,26 @@ export type UpdateRepositoryRequest = {
      * Stored in `repository_config` under `apt_release_version`.
      */
     apt_release_version?: string | null;
+    /**
+     * Update the keyless-sync unverified-ingest opt-in (#2569). When provided,
+     * sets `curation_allow_unverified` (`false` restores the fail-closed
+     * default; `true` opts into legacy unverified ingest). Omit to leave it
+     * unchanged.
+     */
+    curation_allow_unverified?: boolean | null;
+    /**
+     * Default curation action when no rule matches: allow or review.
+     * "block" is rejected (DB CHECK, migration 071); use block rules for
+     * specific packages instead.
+     *
+     * The allowed set is spelled out in the schema so a generated SDK presents it
+     * rather than an unconstrained string.
+     */
+    curation_default_action: string;
+    /**
+     * Enable curation-rule enforcement on this repository's proxy paths.
+     */
+    curation_enabled?: boolean | null;
     /**
      * Update the custom User-Agent for outbound HTTP requests to the upstream.
      * Only valid for remote repositories. Pass an empty string to remove.
@@ -5490,7 +5931,22 @@ export type UpdateUserRequest = {
     is_admin?: boolean | null;
 };
 
+/**
+ * Full-set replace of a virtual repository's members (PR #2795, issue #2785;
+ * ratified in issue #2899).
+ *
+ * This body is the COMPLETE desired member list, not a partial patch. Any
+ * current member whose key is absent from `members` is removed; keys present
+ * are inserted or have their priority updated. An empty `members` array
+ * removes every member.
+ *
+ * WARNING: sending a partial list to reorder priorities deletes the omitted
+ * members. Clients must always send the full member list.
+ */
 export type UpdateVirtualMembersRequest = {
+    /**
+     * The complete desired member set. Members not listed here are removed.
+     */
     members: Array<VirtualMemberPriority>;
 };
 
@@ -5521,10 +5977,22 @@ export type UpsertLicensePolicyRequest = {
  * and an omitted field is never clobbered. See #1374 / B11.
  */
 export type UpsertScanConfigRequest = {
+    /**
+     * Accepted and persisted, but consulted by no gate — enforcement is the
+     * `scan_policies` table's job (#3144; disposition tracked in #3246).
+     */
     block_on_policy_violation?: boolean | null;
+    /**
+     * #2954: `'fail_open'` (default) | `'fail_closed'` for the inline proxy
+     * scan-on-fetch action.
+     */
+    proxy_scan_action?: string | null;
     scan_enabled?: boolean | null;
     scan_on_proxy?: boolean | null;
     scan_on_upload?: boolean | null;
+    /**
+     * Accepted and persisted, but consulted by no production gate (#3243).
+     */
     severity_threshold?: string | null;
 };
 
@@ -5557,8 +6025,33 @@ export type UserResponse = {
     username: string;
 };
 
+export type VersionResponse = {
+    /**
+     * The number of approved packages frozen into the snapshot.
+     */
+    package_count: number;
+    /**
+     * Whether this version's signed repodata has been published yet.
+     */
+    published: boolean;
+    /**
+     * The repository key the version belongs to.
+     */
+    repository: string;
+    /**
+     * The monotonic snapshot number (published/served under `/rpm/{key}/@N/`).
+     */
+    version_number: number;
+};
+
 export type VirtualMemberPriority = {
+    /**
+     * Key of the member repository. Inserted if it is not already a member.
+     */
     member_key: string;
+    /**
+     * Resolution priority. Lower values are searched first.
+     */
     priority: number;
 };
 
@@ -5607,7 +6100,7 @@ export type WasmPluginResponse = {
 /**
  * Webhook event types
  */
-export type WebhookEvent = 'artifact_uploaded' | 'artifact_deleted' | 'repository_created' | 'repository_deleted' | 'user_created' | 'user_deleted' | 'build_started' | 'build_completed' | 'build_failed' | 'age_gate_queued' | 'age_gate_approved' | 'age_gate_rejected';
+export type WebhookEvent = 'artifact_uploaded' | 'artifact_deleted' | 'repository_created' | 'repository_deleted' | 'user_created' | 'user_deleted' | 'build_started' | 'build_completed' | 'build_failed' | 'age_gate_queued' | 'age_gate_approved' | 'age_gate_rejected' | 'age_gate_reopened';
 
 export type WebhookListResponse = {
     items: Array<WebhookResponse>;
@@ -5729,6 +6222,21 @@ export type RejectReviewResponses = {
 
 export type RejectReviewResponse = RejectReviewResponses[keyof RejectReviewResponses];
 
+export type ReopenReviewData = {
+    body: ReviewActionRequest;
+    path: {
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/admin/age-gate/reviews/{id}/reopen';
+};
+
+export type ReopenReviewResponses = {
+    200: AgeGateReviewResponse;
+};
+
+export type ReopenReviewResponse = ReopenReviewResponses[keyof ReopenReviewResponses];
+
 export type GetStaleArtifactsData = {
     body?: never;
     path?: never;
@@ -6087,14 +6595,18 @@ export type ExecuteBackupErrors = {
      */
     404: unknown;
     /**
-     * Internal server error
+     * Another backup is already in progress
+     */
+    409: unknown;
+    /**
+     * The run could not be started or its outcome could not be recorded
      */
     500: unknown;
 };
 
 export type ExecuteBackupResponses = {
     /**
-     * Backup executed
+     * Backup run finished; `status` is `completed` or `failed` and `error_message` carries the cause of a failure
      */
     200: BackupResponse;
 };
@@ -9458,6 +9970,80 @@ export type TriggerCurationSyncResponses = {
 
 export type TriggerCurationSyncResponse = TriggerCurationSyncResponses[keyof TriggerCurationSyncResponses];
 
+export type CreateCurationVersionData = {
+    body?: never;
+    path: {
+        /**
+         * Staging repository key
+         */
+        repo_key: string;
+    };
+    query?: never;
+    url: '/api/v1/curation/repos/{repo_key}/versions';
+};
+
+export type CreateCurationVersionErrors = {
+    /**
+     * No approved packages / packages need re-sync
+     */
+    400: unknown;
+    /**
+     * Not authorized for this repo
+     */
+    403: unknown;
+    /**
+     * Repository not found
+     */
+    404: unknown;
+};
+
+export type CreateCurationVersionResponses = {
+    201: VersionResponse;
+};
+
+export type CreateCurationVersionResponse = CreateCurationVersionResponses[keyof CreateCurationVersionResponses];
+
+export type PublishCurationVersionData = {
+    body?: never;
+    path: {
+        /**
+         * Staging repository key
+         */
+        repo_key: string;
+        /**
+         * Version number to publish
+         */
+        n: number;
+    };
+    query?: never;
+    url: '/api/v1/curation/repos/{repo_key}/versions/{n}/publish';
+};
+
+export type PublishCurationVersionErrors = {
+    /**
+     * Empty version / missing snippet / no signing key
+     */
+    400: unknown;
+    /**
+     * Not authorized for this repo
+     */
+    403: unknown;
+    /**
+     * Repository or version not found
+     */
+    404: unknown;
+    /**
+     * Version already published (immutable)
+     */
+    409: unknown;
+};
+
+export type PublishCurationVersionResponses = {
+    200: VersionResponse;
+};
+
+export type PublishCurationVersionResponse = PublishCurationVersionResponses[keyof PublishCurationVersionResponses];
+
 export type ListCurationRulesData = {
     body?: never;
     path?: never;
@@ -9466,6 +10052,10 @@ export type ListCurationRulesData = {
          * Filter by staging repo
          */
         staging_repo_id?: string;
+        /**
+         * Filter by rule scope: `global` lists only the instance-wide baseline rules (admin-only)
+         */
+        scope?: string;
     };
     url: '/api/v1/curation/rules';
 };
@@ -13577,6 +14167,53 @@ export type GetQuarantineStatusResponses = {
 
 export type GetQuarantineStatusResponse = GetQuarantineStatusResponses[keyof GetQuarantineStatusResponses];
 
+export type QuarantineArtifactNowData = {
+    /**
+     * Optional; empty body uses the default reason
+     */
+    body: QuarantineNowRequest;
+    path: {
+        /**
+         * Artifact ID
+         */
+        artifact_id: string;
+    };
+    query?: never;
+    url: '/api/v1/quarantine/{artifact_id}/quarantine';
+};
+
+export type QuarantineArtifactNowErrors = {
+    /**
+     * Malformed request body
+     */
+    400: unknown;
+    /**
+     * Authentication required
+     */
+    401: unknown;
+    /**
+     * Admin access required
+     */
+    403: unknown;
+    /**
+     * Artifact not found
+     */
+    404: unknown;
+    /**
+     * Artifact was rejected during security review
+     */
+    409: unknown;
+};
+
+export type QuarantineArtifactNowResponses = {
+    /**
+     * Artifact quarantined
+     */
+    200: QuarantineActionResponse;
+};
+
+export type QuarantineArtifactNowResponse = QuarantineArtifactNowResponses[keyof QuarantineArtifactNowResponses];
+
 export type RejectQuarantinedArtifactData = {
     body: RejectRequest;
     path: {
@@ -13872,6 +14509,23 @@ export type ListArtifactsData = {
          * `docker_tags` array.
          */
         group_by?: string | null;
+        /**
+         * Opaque keyset cursor (#2520, #2519, #2518). Pass the `next_cursor`
+         * value from the previous response to fetch the next page; `page` is
+         * ignored while a cursor is present. Supported by the flat artifact
+         * listing of hosted/local, virtual, and remote repositories (#2518,
+         * #2519), by `group_by=docker_tag`, and by `group_by=maven_component`
+         * on remote repositories; other listing modes ignore it.
+         */
+        cursor?: string | null;
+        /**
+         * Total-count mode for keyset-paged listings (#2520, #2519).
+         * `count=exact` runs a dedicated COUNT query so `pagination.total` is
+         * exact; otherwise the keyset-paged listings report a cheap lower bound
+         * (rows seen so far, +1 when another page exists) and `has_more` is the
+         * authoritative "is there a next page" signal.
+         */
+        count?: string | null;
     };
     url: '/api/v1/repositories/{key}/artifacts';
 };
@@ -14469,13 +15123,17 @@ export type UpdateVirtualMembersData = {
 
 export type UpdateVirtualMembersErrors = {
     /**
-     * Repository is not virtual
+     * Repository is not virtual, or a member is invalid
      */
     400: unknown;
     /**
      * Authentication required
      */
     401: unknown;
+    /**
+     * Insufficient permissions
+     */
+    403: unknown;
     /**
      * Repository not found
      */
@@ -14484,7 +15142,7 @@ export type UpdateVirtualMembersErrors = {
 
 export type UpdateVirtualMembersResponses = {
     /**
-     * Members updated
+     * Members replaced with the supplied set
      */
     200: VirtualMembersListResponse;
 };
@@ -14919,6 +15577,82 @@ export type GetRepositoryStorageResponses = {
 
 export type GetRepositoryStorageResponse = GetRepositoryStorageResponses[keyof GetRepositoryStorageResponses];
 
+export type RunRepositoryStorageGcData = {
+    body: StorageGcRequest;
+    path: {
+        /**
+         * Repository key
+         */
+        key: string;
+    };
+    query?: never;
+    url: '/api/v1/repositories/{key}/storage-gc';
+};
+
+export type RunRepositoryStorageGcErrors = {
+    /**
+     * Authentication required, or admin privileges required
+     */
+    401: unknown;
+    /**
+     * Repository not found
+     */
+    404: unknown;
+};
+
+export type RunRepositoryStorageGcResponses = {
+    /**
+     * GC result
+     */
+    200: StorageGcResult;
+};
+
+export type RunRepositoryStorageGcResponse = RunRepositoryStorageGcResponses[keyof RunRepositoryStorageGcResponses];
+
+export type GetRepositoryStorageTreeData = {
+    body?: never;
+    path: {
+        /**
+         * Repository key
+         */
+        key: string;
+    };
+    query?: {
+        /**
+         * Folder prefix to root the listing at (`''`/absent = repository root).
+         * Leading/trailing slashes are ignored.
+         */
+        prefix?: string | null;
+        /**
+         * How many tree levels below `prefix` to return (default 1 = immediate
+         * children, clamped to 1..=5).
+         */
+        depth?: number | null;
+        /**
+         * Maximum number of descendant nodes returned (default 200, clamped to
+         * 1..=1000). `truncated` is set when the limit cut the listing.
+         */
+        limit?: number | null;
+    };
+    url: '/api/v1/repositories/{key}/storage/tree';
+};
+
+export type GetRepositoryStorageTreeErrors = {
+    /**
+     * Repository not found
+     */
+    404: unknown;
+};
+
+export type GetRepositoryStorageTreeResponses = {
+    /**
+     * Per-prefix storage rollup
+     */
+    200: RepositoryStorageTreeResponse;
+};
+
+export type GetRepositoryStorageTreeResponse = GetRepositoryStorageTreeResponses[keyof GetRepositoryStorageTreeResponses];
+
 export type TestUpstreamData = {
     body?: never;
     path: {
@@ -18167,7 +18901,7 @@ export type RotateWebhookSecretErrors = {
 
 export type RotateWebhookSecretResponses = {
     /**
-     * Secret rotated. Body includes the new raw secret exactly once.
+     * Secret rotated. Body reports success and metadata only; the raw secret is not returned.
      */
     200: RotateWebhookSecretResponse;
 };